Cyber Incident Detection/Response Analyst (Mid)

NTT DATA Services•Springfield, VA

2d•$96,492 - $144,738•Onsite

About The Position

NTT DATA is hiring a Cyber Incident Detection/Response Analyst to defend a client’s enterprise IT environment against evolving cyber threats. The role investigates security incidents, analyzes suspicious activity, coordinates response and remediation, and helps improve the ability to detect, respond to, and recover from cyberattacks across interconnected networks, cloud platforms, and mission-critical systems. The analyst performs Tier 2 investigation, response coordination, containment, and remediation tracking for complex events affecting enterprise systems and networks. The position is based on-site in Springfield, Virginia, and supports 24x7x365 operations, including rotating shifts, nights, weekends, and federal holidays as needed. The analyst must hold an active Top Secret security clearance and an active qualifying cybersecurity incident-response certification. The starting pay range is $96,492–$144,738. Compensation depends on factors including relevant experience, technical skills, and other qualifications; the role may also be eligible for incentive compensation based on individual and/or company performance. Benefits include medical, dental, and vision insurance with an employer contribution; flexible spending or health savings accounts; life and AD&D insurance; short- and long-term disability coverage; paid time off; employee assistance; a 401(k) program with company match; and additional voluntary or legally required benefits.

Requirements

At least 6 years of cybersecurity incident detection, response, investigation, or SOC experience.
Active cybersecurity incident-response certification, such as CompTIA CySA+, GIAC GCIH, GIAC GCFA, or an equivalent validated against the assigned 8140 work role.
Ability to work on-site in Springfield, Virginia, including rotating shifts, nights, weekends, and federal holidays as needed to support 24x7x365 operations.
Active Top Secret Security Clearance.

Nice To Haves

Experience in incident command, endpoint and network forensics, threat intelligence, cloud investigations, phishing/malware response, and MITRE ATT&CK.
Working knowledge of Splunk, Microsoft Sentinel or comparable SIEM, enterprise EDR, ServiceNow, and federal incident-handling procedures.

Responsibilities

Investigate security events using SIEM, EDR, IDS/IPS, firewall, antivirus, web-filtering, and threat-intelligence data.
Correlate indicators, host and network artifacts, and adversary behavior to determine incident scope, severity, probable root cause, and operational impact.
Coordinate containment, eradication, recovery, and stakeholder communications using approved incident-response processes and authority.
Lead focused technical incident-response activities or shifts when assigned, coordinating with SOC/NOC staff and external incident-response partners.
Conduct host forensic triage and support malware analysis in controlled environments, as authorized; preserve evidence and chain of custody.
Perform quality assurance on incident documentation and closure, identify recurring patterns, and improve playbooks and knowledge articles.